The discovery of malicious plugins on the JetBrains Marketplace demonstrates how attackers are increasingly targeting developers through the tools they use every day. At least 15 plugins, published through seven vendor accounts and collectively installed nearly 70,000 times, reportedly posed as AI coding assistants, code-review utilities, and Git-related tools connected to services such as OpenAI, DeepSeek, and SiliconFlow. ([BleepingComputer][1])

What makes this campaign particularly concerning is that the plugins reportedly performed their advertised functions while secretly stealing the AI API keys entered into their settings. The credential theft was triggered when the developer clicked “Apply,” after which the key was transmitted over unencrypted HTTP to a hardcoded external server. This allowed the malicious functionality to remain largely invisible during ordinary use. Apparently, software can now be useful and malicious at the same time, because attackers have discovered that incompetently broken malware attracts too much attention. 

The campaign is believed to have been active since October 2025, with additional plugins appearing as recently as June 10, 2026. Researchers also identified common code across the plugins, indicating a coordinated operation rather than several unrelated incidents. At the time the report was published, at least one plugin containing the credential-stealing functionality reportedly remained available through the marketplace. 

AI API keys are not harmless configuration values. Depending on their permissions and the service involved, stolen keys may allow attackers to consume paid AI resources, generate significant charges, access stored data, interact with organization-specific models, abuse connected applications, or conduct malicious activity under the victim’s account. Where the same credential is reused across development, testing, CI/CD, or production environments, the impact can extend far beyond the developer’s workstation.

The reported operation may also have involved an unusual credential resale model. The plugins included a paid tier under which users could receive working AI API keys from the attackers’ server. Researchers believe it is possible that credentials stolen from some users were subsequently supplied to paying users, effectively converting compromised developer accounts into a pool of unauthorized AI resources. This possibility had not been conclusively established when the report was published, but the observed plugin behaviour raised that concern. ([BleepingComputer][1])

For enterprises, the larger issue is the privileged position occupied by developer workstations. An IDE may have access to source code, private repositories, environment variables, SSH keys, cloud credentials, package registries, databases, CI/CD systems, internal documentation, and production infrastructure. A malicious plugin installed inside that environment can therefore become far more dangerous than an ordinary desktop application.

Organizations should not assume that a plugin is safe merely because it appears in an official marketplace. JetBrains itself warns that installing plugins introduces security risks, while its marketplace process subjects new plugins and updates to review and approval. Marketplace review reduces risk, but it cannot replace an organization’s own controls, particularly when malicious functionality is concealed inside otherwise operational software. 

Customers using JetBrains IDEs should identify whether any affected plugins were installed and immediately revoke and rotate AI API keys associated with them. Rotation should include credentials stored in IDE settings, environment variables, local configuration files, secret-management systems, CI/CD pipelines, and shared development accounts. Simply uninstalling a plugin is insufficient once a credential may already have been transmitted externally.

Organizations should also review AI-provider logs for unexplained token consumption, unfamiliar IP addresses, unusual models being invoked, unexpected geographic activity, sudden usage spikes, and requests occurring outside normal development hours. Billing anomalies should be treated as possible indicators of credential compromise rather than merely enthusiastic experimentation by developers.

A stronger enterprise response should include an approved-plugin policy, centralized inventories of IDE extensions, restricted installation rights, validation of plugin vendors and permissions, and periodic reviews of installed versions. Automatic plugin updates should also be monitored because a previously legitimate extension can become dangerous after an account takeover or malicious update. Humans appear to have recreated the software supply chain inside the code editor, complete with all the same weaknesses but conveniently closer to the source code.

AI credentials should be individually assigned, narrowly scoped, regularly rotated, and protected through a centralized secrets-management platform. Development, testing, and production keys should remain separate. Usage limits, spending caps, service restrictions, IP controls, and short-lived tokens should be enabled wherever supported. Shared unrestricted API keys make incident investigation and containment unnecessarily difficult.

Network controls provide another important layer of protection. Developer systems should not be allowed to communicate freely with arbitrary external destinations. DNS monitoring, web filtering, application control, TLS inspection where legally and operationally appropriate, and outbound traffic analysis can help identify plugins transmitting credentials or source data to suspicious infrastructure. The reported use of plain HTTP in this campaign is precisely the kind of anomalous outbound behaviour that network security controls should be capable of detecting and blocking. 

Enterprises should further monitor developer endpoints for unusual plugin installations, modifications to IDE directories, suspicious child processes, unauthorized access to credential stores, and unexpected connections initiated by development tools. These signals should be correlated with identity, firewall, DNS, endpoint, repository, cloud, and AI-service logs so that an apparently minor IDE event can be recognised as part of a broader attack.

This incident reinforces a wider shift in the threat landscape. Attackers are targeting not only deployed applications, but also the developers, extensions, packages, AI assistants, and automation tools involved in creating them. Compromising one developer can provide access to code, credentials, infrastructure, and trusted software-delivery pipelines, making the development environment a strategic target.

The key lesson for customers is that developer tooling must be governed as part of the enterprise security architecture. Plugins should be verified, credentials should be protected and monitored, outbound communication should be controlled, and suspicious behaviour should be detected across both the endpoint and network. Trusting a marketplace badge or a high installation count is no longer sufficient. Attackers understand that the fastest route into an organization may not be through its public servers, but through a helpful-looking button inside a developer’s IDE.

At least 15 malicious plugins found on the JetBrains Marketplace were designed to steal AI API keys from developers. [...]

Source: Malicious JetBrains Marketplace plugins steal AI API keys from developers via Bleeping Computer — published 16 Jun 2026.